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About Window Restrictions 


In Microsoft Internet Explorer, scripts can open two different types of windows and can resize and reposition existing windows. 
Malicious coders have used these script-opened windows and the script-driven window positioning to mislead and deceive users. 
The Window Restrictions security feature in Internet Explorer 6 for Microsoft Windows XP Service Pack 2 (SP2) now restricts the 
opening and placement of windows by script to prevent malicious coders from misleading users. These restrictions include 
constraints on new Internet Explorer windows created by the window . open method and HTML pop-up windows created by the 
window. createPopup method, and positioning and sizing of Internet Explorer windows. By understanding Window Restrictions 
and how they work, you can write your scripts so that your Web pages function as expected. 

This document assumes that you are familiar with Dynamic HTML (DHTML) and scripting. 

The following topics are discussed in this document. 

• Why Do We Need Window Restrictions? 

• Window-opening Methods Affected by Window Restrictions 

• Restrictions on Internet Explorer Frame Windows 

• Guidelines for Scripting Internet Explorer Frame Windows 

• Restrictions on Internet Explorer HTML Pop-up Windows 

• Guidelines for Scripting HTML Pop-up Windows 

• Related Topics 

Why Do We Need Window Restrictions? 

The visible security features of Internet Explorer windows, such as the status bar, provide information to users to help them 
determine the source of a Web page and the security of that Web page. Hiding these features can lead users to think that they 
are on a trusted page or that they are interacting with a system process when they are actually interfacing with a malicious host. 
Maliciously relocating or hiding a window can present the user with false information, can obscure important information, or can 
even spoof (that is, imitate) important elements of the user interface, all in an attempt to get the user to take unsafe actions or to 
divulge sensitive information. 

Internet Explorer 6 for Windows XP SP2 requires that the window title bar and status bar are always in the visible area of the 
display; if the address bar is displayed, it must also remain visible. By placing these restrictions on script-opened windows, the 
Window Restrictions security feature prevents malicious code from hiding information and from spoofing user interfaces. The 
Window restrictions feature is on by default for the Internet zone, and the feature is off by default for the Local Intranet and 
Trusted Sites zones. 

Window restrictions are managed through a feature control registry key ( FEATURE WINDOW_RESTRICTIONS ). Applications 
hosting the WebBrowser Control can take advantage of these restrictions. For more information, see Window Restrictions 

Window-opening Methods Affected by Window Restrictions 

There are two methods by which you can call in scripts to open windows. 

• window.open This method creates new Internet Explorer frame windows that can include such interface elements as a status 
bar, an address bar, and a title bar. These interface elements are often referred to as "chrome." The presence of these 
elements in an Internet Explorer frame window is determined by the sFeatures parameter of the window.open call. 

• window.createPopup This method creates HTML pop-up windows, or "chromeless" windows (that is, without the interface - 
elements mentioned above). The caller determines the appearance of these HTML pop-up windows. 

Restrictions on Internet Explorer Frame Windows 

Window restrictions constrain script-driven placement of new Internet Explorer frame windows and script-driven positioning of 
existing frame windows to ensure that the status bar, title bar, and address bar (if displayed) always remain visible after the open 
operation is complete. There are several ways in which window restrictions constrain windows created by the window.open 
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method. 

Script Positioning of Internet Explorer Windows 

Window positioning on the screen can be dictated by scripts that call the window.open method. Prior to Internet Explorer 6 for 
Windows XP SP2, script-opened windows could potentially be placed anywhere, including entirely off the screen and hidden from 
the user. 

When a script opens a new Internet Explorer frame window, window restrictions constrain the window's placement so that the 
status bar and the title bar in the window are always visible. Scripts themselves cannot move a window offscreen, although the 
user can move the window offscreen after it has opened. If your script attempts to open a window offscreen, Internet Explorer will 
reposition the window by the smallest distance necessary so that the window appears onscreen. 

To ensure that your Internet Explorer frame windows appear in the proper position onscreen, and to ensure that Internet Explorer 
does not reposition your windows to an undesired location on the screen, set the position parameters to window.open() as 
follows: 

• left Property; sets position relative to the upper-left corner of the display containing the Internet Explorer window that is 
calling window.open to display the new window. Value must be greater than or equal to 0. 

• top Property; sets position relative to the upper-left corner of the display containing the Internet Explorer window that is 
calling window.open to display the new window. Value must be greater than or equal to 0. 

Window restrictions also constrain script-driven positioning of existing frame windows so that the status bar, title bar, and address 
bar (if displayed) are always visible to the user. If your script initiates movement of existing frame windows, be sure to set the 
position parameters as follows: 

• left Property; sets position relative to the upper-left corner of the display containing the Internet Explorer window that is 
calling window.open to display the new window. Value must be greater than or equal to 0. 

• right Property; sets position relative to the upper-right corner of the display containing the Internet Explorer window that is 
calling window.open to display the new window. Value must be greater than or equal to 0. 

• moveTo Method; moves the screen position of the upper-left corner of the window to the specified coordinates. iX specifies the 
horizontal scroll offset in pixels, and iY specifies the vertical scroll offset in pixels. Both values must be greater than or equal to 
zero. 

• moveBy Method; moves the screen position of the window by the specified iX and iY offset values. iX specifies the horizontal 
scroll offset in pixels, and iY specifies the vertical scroll offset in pixels. Both values must be greater than or equal to zero. 

Script Sizing of Internet Explorer Windows 

Window size can be set by scripts that call the window.open method. Prior to Internet Explorer 6 for Windows XP SP2, script- 
opened Internet Explorer frame windows could be sized so that the status bar was not visible on the screen. The status bar could 
be hidden either by making the windows extremely small or by making the windows larger than the screen. 

Window restrictions constrain the maximum size of script-opened frame windows. Along with the positioning constraints described 
above, these restrictions ensure that the status bar'and the title bar are always visible to the user. Scripts cannot size windows so 
that the status bar is not visible, nor can scripts open windows in kiosk mode. Kiosk mode is a mode that does not display the title 
bar, the status bar, or the address bar. 

Note The user can still choose to open windows in kiosk mode; the user or site administrator can also manually change this 
state. 

Script Management of Internet Explorer Status Bar 

The status bar is an Internet Explorer security feature that provides the user with Internet Explorer security zone information. 

Prior to Internet Explorer 6 for Windows XP SP2, the status bar could be hidden from the user by scripts that call the 
window.open method. With the status bar hidden from view, users could be deceived into thinking that they were on a trusted 
site when they were actually interacting with a malicious host. 

With window restrictions in place, the status bar cannot be turned off for any window created by the window.open method; it is 
always visible for all Internet Explorer windows. The zone information that the status bar contains cannot be spoofed or hidden 
from view, so that the user always knows in what security zone the content is being displayed. 
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Guidelines for Scripting Internet Explorer Frame Windows 

To obtain the best results and to avoid unexpected outcomes with your script-opened Internet Explorer frame windows, follow 
these guidelines when you code windows that open by using the window.open method. 

• The status bar is always on by default, so be sure that your code allows for the space the status bar takes up in the display. 
Allow 20-25 pixels for the height of the status bar. 

• To account for the status bar, you might need to modify scripts that use resizeTo method calls to resize new frame windows 
that do not have a status bar. The size parameters for the resizeTo method are for the entire Internet Explorer frame window. 

• The window will not cover the taskbar. Be sure your window is sized vertically so that it is no more than 30 pixels outside the 
taskbar. Code your windows so that they fit well visually with the window’s overall size. 

• Windows will not open offscreen. If a window is coded to open offscreen, Internet Explorer will reposition it by the smallest X 
and Y coordinates so that the window opens fully onscreen. Position your windows so that they open onscreen and in the 
correct location by always using positive integers for your position parameters. 

• Be sure that your script takes into account the fact that if your script calls window.open with the fuiiscreen=yes 
specification, the result is a maximized window, not a window in the kiosk mode. 

• Be sure to account for user UI settings for font size, display theme, and screen resolution when you code your windows. 

Restrictions on Internet Explorer HTML Pop-up Windows 

Window restrictions constrain script-opened HTML pop-up windows, also known as "chromeless" windows, to ensure that the 
windows do not obscure important user interface elements of the parent Internet Explorer window. There are several ways in 
which window restrictions constrain HTML pop-up windows that are created by the window.createPopup method. 

Script Positioning of HTML Pop-up Windows 

Pop-up window position on the screen can be dictated by scripts that call the window.createPopup method. Prior to Internet 
Explorer 6 for Windows XP SP2, script-opened HTML pop-up windows could potentially be placed anywhere, so that they could 
either obscure or replace important elements or information. HTML pop-up windows could also open entirely offscreen and be 
hidden from the user. HTML pop-up windows were also created as "topmost" windows, which means that they would overlay other 
windows related to the Internet Explorer window opening the HTML pop-up window; in particular, HTML pop-up windows could 
overlay dialog boxes opened by Internet Explorer. 

The window restrictions feature places two constraints on the positioning of HTML pop-up windows: 

1. HTML pop-up windows must be entirely onscreen horizontally, and must overlap the parent window horizontally. If the show Q 
call attempts to place the HTML pop-up window partially or completely off the visible display area, or in a position that does 
not horizontally overlap the window containing the script showing the HTML pop-up window, Internet Explorer will reposition 
the the HTML pop-up window by the smallest distance necessary so that the HTML pop-up window appears fully onscreen and 
overlaps the parent window horizontally. 

2. HTML pop-up windows must appear between the top of the parent window (typically the bottom of the address bar) and the 
bottom of the parent window (typically the top of the Internet Explorer status bar). If necessary, Internet Explorer will 
reposition or shrink the vertical size of the HTML popup (or both) to ensure that it meets the vertical positioning constraints. 

In addition, HTML pop-up windows are no longer "topmost" windows. HTML pop-up windows will remain immediately above the 
Internet Explorer window from which they are shown. Scripts cannot change an HTML pop-up window's z-order. 

Windows created with the window.createPopup method are displayed by using the window.show method. To ensure that your 
HTML pop-up windows appear in the proper position onscreen, and that Internet Explorer does not reposition your pop-up 
windows to an undesired location on the screen, set your position parameters as follows, where iX=the x-coordinate of the HTML 
pop-up window in pixels, and iY=the y-coordinate of the pop-up window in pixels. You can also optionally specify an element to 
which you want your HTML pop-up window to be relative. 

• iX = integer; sets position relative to the upper-left corner of the specified element. If you do not specify an element to which 

your window is relative, iX is relative to the desktop. The value of iX must be greater than or equal to 0. 

• iY = integer; sets position relative to the upper-left corner of the specified element. If you do not specify an element to which 

your window is relative, iY is relative to the desktop. The value of iY must be greater than or equal to 0. 

Script Sizing of HTML Pop-up Windows 
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Pop-up window size can be dictated by scripts that call the window.createPopup method. Prior to Internet Explorer 6 for 
Windows XP SP2, script-opened HTML pop-up windows could be sized to cover the entire screen so that the window could obscure 
important security elements and spoof the user interface or the desktop. The code could also hide malicious information or activity 
from the user. 

In addition to repositioning HTML pop-up windows, the Window restrictions feature constrains the size of HTML pop-up windows so 
that they cannot cover the address bar or the Internet Explorer status bar. If you size a window with dimensions taller than 
allowed, the HTML pop-up window will be truncated so that it appears on the screen only between the status bar on the bottom 
and the address bar on the top. The HTML pop-up window's content will also be truncated, so that your content appears to be cut 
off, and important information can be lost below the status bar. 

Guidelines for Scripting HTML Pop-up Windows 

Follow these guidelines when you code HTML pop-up windows that open by using the window.createPopup method. 

• Window restrictions will not allow HTML pop-up (chromeless) windows to cover the parent window’s status bar or title bar. 

Code your windows so that they are vertically sized no larger than the currently visible area of the page. 

• HTML pop-up windows will not open offscreen. If a window is coded to open offscreen, Internet Explorer will reposition it by the 

smallest X and Y coordinates so that the window opens fully on screen. Position your HTML pop-up windows so that they open 
onscreen. 

• Be sure to plan for the fact that Internet Explorer no longer allows more than one pop-up window per page. 

• As with new Internet Explorer frame windows, be sure to account for user UI settings for font size, display theme, and screen 

resolution when you code your HTML pop-up windows. 

Related Topics 

• Internet Explorer Window Restrictions 

• open 

• createPopup 

• About the Pop-up Blocker 
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• PLATO Web Learning Network (PWLN) 

• Client-Hosted PLATO Web Learning Network (CHPWLN) 

• Web-based Flash courseware 

• The PLATO Network (TPN) 

• PLATO Learning Environment (PLE) 

SYMPTOMS 

m 

You can log in to PLATO Web Learning Network successfully, but are unable to launch a lesson. The message "Please wait..." 
displays: 


HP 


->♦<- 


Eventually, the following message displays and the courseware lesson does not launch: 


Click here when your lesson or test ls cornplete. 


When you try to launch a lesson, a yellow information bar appears below the Internet Explorer address bar. The message on the 
information bar is similar to one of the following: 


HI $$$';dtdc here<, 4 
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For "The PLATO Network" users, when you try to launch an assignment listed in "My Assignments", nothing appears to happen. 
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CAUSE 


You may have one or more pop-up blockers installed on your workstation. Pop-up blockers will prevent PLATO lessons from 
launching successfully. 


http://support.plato.com/kb/tip_print.asp?psid=25636 
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Pop-up blockers prevent extra pop-up windows (usually advertisements) from opening in your browser. To block some types of 
pop-up ads, pop-up blockers disable JavaScript. However, legitimate software applications also use JavaScript. If your pop-up 
blocker disables JavaScript, it prevents PLATO lessons from launching. PLATO Web Learning Network courseware uses JavaScript 
and requires it to be enabled. 

There are hundreds of pop-up blockers available. Examples of the most common pop-up blockers include: 

• Adobe Reader 7.0 with Yahoo Toolbar 

• Google Toolbar with Pop-Up Blocker 

• MSN Search Toolbar 

• Norton AntiSpam 

• Norton Internet Security 

• Norton Personal Firewall 

• Shockwave Player 10.0.1 with Yahoo Toolbar installed (Internet Explorer on Windows workstations) 

• Yahoo Toolbar with Pop-Up Blocker 

• Windows XP with Service Pack 2 installed 

• ZoneAlarm 


SOLUTION 

"BUT I KNOW MY POP-UP BLOCKER IS TURNED OFF!" 

If your pop-up blocker is turned off and your lesson still won't launch, another pop-up blocker may be running on your 
workstation without your realizing it. Because pop-up blockers have increased in popularity and are being included for free with 
toolbars and software, it's common to have three or more pop-up blockers on your computer. 

You can verify whether another pop-up blocker is preventing you from running lessons or not by clicking the following link: 
http://www.popuptest.com/popuptestl.html 

If no pop-up windows display when you run this test, then you still have a pop-up blocker on your workstation and it is turned on. 

FIND ALL OF THE POP-UP BLOCKERS ON YOUR COMPUTER 


Identifying all of the pop-up blockers you have running can take some time, so you'll need to be patient. Some of the pop-up 
blockers you are likely to have on your computer include the following: 

• Pop-up blocker with Internet Explorer (if you have Windows XP Service Pack 2 or higher installed on your workstation) 

• Pop-up blockers on the Google, Yahoo, and MSN toolbars 

• Pop-up blockers included with Norton Internet Security and Norton AntiSpam 

• Additional third party pop-up blockers, such as ZoneAlarm, may also be installed. Instead of being on a toolbar in your 
web browser, these may appear in your System Tray (on the Windows taskbar at the bottom right of your screen). 


Hidden toolbars may contain pop-up blockers that are enabled without your realizing it, because you can't see them. To check for 
hidden toolbars that are not visible on your screen, but are installed behind the scenes, click View > Toolbars in your browser 
window. A menu similar to the one shown below will display. 

In the example below, the Google toolbar is not selected, so the toolbar is hidden - you can't see it in the browser window. 
However, the pop-up blocker for the Google toolbar is still enabled and functioning... which means it's preventing lessons from 
launching. 
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Hidden toolbars 



To turn off pop-up blockers on hidden toolbars, select the hidden toolbars. This will enable you to see them in your browser 
window so that you can turn off the popup blockers. 

After you identify all of the pop-up blockers on your workstation, you'll need to decide which pop-up blocker you want to use. 

USE ONLY ONE POP-UP BLOCKER 

To prevent conflicts, Microsoft recommends that you use only one pop-up blocking program at a time. In general, you can use 
the pop-up blocker you like the most, and either turn off or uninstall the others. 

If Windows XP Service Pack 2 or later and the MSN toolbar are both installed on your computer, Microsoft recommends that you 
only use the Internet Explorer pop-up blocker (from Windows XP Service Pack 2). Turn off the MSN Search Toolbar pop-up 
blocker. 

Determine which pop-up blocker you are going to use. You'll need to either turn it off each time you want to run PLATO lessons, 
or configure it to allow pop-ups from your PLATO web site. 

All other pop-up blockers that you will not be using should be turned off (disabled) or removed completely (uninstalled) from your 
workstation. 

HOW TO TURN OFF OR CONFIGURE A POP-UP BLOCKER 

The procedures to turn off or configure pop-up blockers differ, depending on the pop-up blocker(s) you are using. Look for help 
files in your pop-up blocker for instructions, or look for menus or buttons on the toolbar that you can click to turn the blocker off. 

Other pop-up blockers, such as ZoneAlarm, can be turned off by clicking the pop-up blocker icon on the System Tray at the 
bottom right of your Windows screen). 

The links below provide instructions for turning off or configuring common pop-up blockers. 
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GOOGLE TOOLBAR 

1. Launch your browser. 

2. Navigate to the web site for your PLATO product. (For example, go to the login page for PLATO Web Learning Network.) 

3. Click the "blocked" button to always allow content from the site: 
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The pop-up blocker will remember the site and allow pop-up windows to launch. 
Another option is to press and hold the CTRL key down each time you launch PLATO lessons. 
More about the Google pop-up blocker 


INTERNET EXPLORER AND WINDOWS XP SERVICE PACK 2 

If your version of Internet Explorer has a pop-up blocker, you have Windows XP Service Pack 2 or later installed. To run PLATO 
lessons successfully, you will need to configure both the pop-up blocker and firewall installed by the the Service Pack. 


Configure the pop-up blocker 

Follow these steps if you see the information bar "Pop-blocked. 




1. Click the information bar. 

2. Click "Always allow pop-ups from this site." You should now be able to launch lessons successfully. 

Follow these steps if you don't see the information bar "Pop-up blocked..." 

1. If you don't see the information bar below your browser's address bar, click Tools > Pop-up Blocker > Pop-up Blocker 
Settings. 

2. In the Address of Web site to allow box, type the web address for your PLATO web site, and then click Add. 

3. Click Close. You should now be able to launch lessons successfully. 

Configure the firewall 

Follow the firewall configuration steps in article 27424 - Unable to launch lessons with Windows XP Service Pack 2 installed. 

More info 

More about the Internet Explorer pop-up blocker 
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MSN SEARCH TOOLBAR 


If you have Windows XP Service Pack 2 or later on installed on your computer, you also have the Internet Explorer pop-up 
blocker. To prevent possible conflicts, Microsoft recommends that you use only the Internet Explorer Pop-up Blocker, and turn off 
the MSN Search Toolbar Pop-up Blocker. Microsoft may display the following dialog to prompt you to choose one or the other. 
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If you see this dialog, choose the Windows XP Pop-up Blocker, then follow the rest of the prompts. The MSN pop-up blocker will 
be turned off. 

If you don't see the prompt to choose a pop-up blocker, or you don't have Internet Explorer, follow the steps below to either turn 
off or configure the MSN pop-up blocker. 


How to turn off the MSN Search Toolbar pop-up blocker 


1. On the MSN Toolbar, click the arrow next to the Pop-up Blocker button, and then click Options. 
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2. Clear the Turn on Pop-up Blocker check box. 

3. Click OK. 


How to configure the MSN Search Toolbar pop-up blocker 

1. On the MSN Toolbar, click the arrow next to the Pop-up Blocker button, and then click Options. 

2. Under "Allow list", type the web address (URL) of the PLATO web site for which you want to allow pop-up windows. 

3. Click Add. 


NORTON ANTISPAM & NORTON INTERNET SECURITY 


To run PLATO lessons successfully with Norton Internet Security installed, you'll need to turn off the pop-up blocker and configure 
the firewall. Follow the steps below for your version of Norton Internet Security. 


http:// support, plato.com/kb/tip_pri nt. asp? psi d=2 5636 
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Norton Anti-Spam & Internet Security 2005 

1. In the main window, on the left side click Norton AntiSpam. 

2. Click Pop-up Blocking > Turn Off. 

3. Follow the instructions to configure the firewall in article 27697 - Unable to connect to CTX.PLATOWEBxx.COM when 
Norton Internet Security is installed. 

NOTE: Norton AntiSpam also has an Ad Blocker, but it does not affect PLATO products. Only the pop-up blocker needs to be 
turned off when you use PLATO web products. 

Norton Internet Security 2004 and earlier 

1. In the main window, double-click Ad Blocking. 

2. Uncheck Pop-up Window Blocking. 

3. Click OK. 

4. Content from the PLATO web site may still be blocked because of information that is stored in your web browser's cache. 
Clear your browser's cache for the changes to work. 

5. Follow the instructions to configure the firewall in article 27697 - Unable to connect to CTX.PLATOWEBxx.COM when 
Norton Internet Security is installed. 






i • ***•*,***•. *. • • *. ■. *. *.r *, *. *.*.*»*. *. % *.*.*.*. •. ■. ■. *.*.*.*.*. t. *. *,*. *. *. *.v. r*. *. ■*.*.*.*.’. **. *. * * * *. *.* 


YAHOO TOOLBAR 

Choose one of the following methods to override the pop-up blocker: 

• Turn off the Pop-Up Blocker by clicking the Pop-Up Blocker button and unchecking Enable Pop-Up Blocker. 



• Press and hold the CTRL key while you are launching PLATO lessons . This will override the pop-up blocker and allow 
PLATO lessons to run. 

• Add PLATO content to your Allowed List by clicking the Pop-Up Blocker button and selecting Always Allow Pop-Ups From.... 
Then select the site (for example, www.platoweb.com) from the Sources of Recently Blocked Pop-Ups list and click Allow. 

If you are unable to configure the pop-up blocker to allow PLATO content, the Google toolbar and pop-up blocker may be running 
in the background. To check this, right-click on your browser toolbar. If "Google" appears in the menu that displays, select it. The 
Google toolbar will appear. Either uninstall the toolbar or turn the Google pop-up blocker off. You should then be able to configure 
the Yahoo pop-up blocker successfully. 

More about the Yahoo Toolbar pop-up blocker 










ZONEALARM 

1. Right-click the ZoneAlarm icon on the system tray on your taskbar (bottom right of your screen): 



2. Click the option to turn Zone Alarm off (for example, click "Shutdown ZoneAlarm Pro"). 

To configure the ZoneAlarm firewall to allow PLATO content, see the documentation for your ZoneAlarm product. For user guides 


http://support.plato.com/kb/tip_print. asp?psid=25636 
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or additional help, contact ZoneAlarm Technical Support . 
ZoneAlarm Support Center FAOs 




HOW TO COMPLETELY REMOVE (UNINSTALL) POP-UP BLOCKER PROGRAMS 

You may wish to uninstall one or more pop-up blocker programs that you will not be using. 

Some programs require that you remove them completely. Others, like E-Anthology/Stop-Sign, are often installed by file sharing 
programs like Bear Share or Kazaa. You may want to remove these programs as well, since they use up system resources and 
make your system vulnerable to adware, spyware, and browser hijacking. 

To remove or uninstall a pop-up blocker program, use the Add/Remove Programs utility in Windows. Follow these steps: 

1. Click Start > Settings > Control Panel > Add/Remove Programs. 

2. Look for the name of the program installed (such as Pop-up Begone). 

3. Select the program name, and then click Remove. 

4. Follow any instructions you are given, then close the Control Panel. 


*»**»*• *••••*• ■ i,» t k t * t t • * *••• • I 
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